Privacy Policy — Email Viewer: EML & MSG
This policy explains how Email Viewer handles information when you open an .eml or
.msg file from an item’s Files columns or update attachments in monday.com.
Viewing email files
Email Viewer reads the email file you choose in the browser so it can display the message and its attachment details in the item. Remote images and tracking pixels are not loaded. Opening an email does not by itself start AI processing.
Optional AI processing
AI processing starts only after you select Summarize with AI and accept the data notice. The app sends the email subject, sender, recipients, date, and up to 12,000 characters of text to the Email Viewer server on monday code in the EU region. That server sends the same information to OpenAI so it can produce a summary, requests with exact quotes, and deadlines. Attachments are not sent to AI. A hash of the monday account and user IDs is sent to OpenAI as a safety identifier. OpenAI processes the supplied text under its API data policies.
AI output can be wrong. You review requests, quotes, and dates before choosing whether to create subitems on the board.
Temporary Marketplace review access
Normally, AI requires Connect monday and an eligible subscription. While Marketplace review is in progress, a temporary review exception permits AI without them, up to 20 AI attempts per public IP per UTC day. Acceptance of the data notice, a valid non-viewer session, and the other request limits still apply. The operator turns this exception off after review; approval does not turn it off automatically.
Temporary review quota
For this temporary review exception, monday Document DB stores only an HMAC fingerprint of the public IP, the UTC day, a count, and an expiry time. It does not store the raw IP, email content, or session tokens in this quota record. The record expires at the end of its UTC day. Expired quota records are explicitly removed when the next valid temporary-review request arrives, so they may remain until then. An hourly job on the server also removes expired quota records. Turning off the exception does not itself erase the records; after review, the operator removes the temporary quota collection.
Services the app communicates with
The Email Viewer server on monday code (EU region) sends requests to these hosts and to no others:
api.openai.com (OpenAI Responses API) receives the email subject, sender, recipients, date, and up to 12,000 characters of text, only after you click Summarize with AI and accept the data notice, to produce the summary, requests, and deadlines. Attachments are never sent.
api.monday.com (monday GraphQL API) is used by the server to read your account ID and app subscription before an AI request.
auth.monday.com (monday OAuth) is used when you connect your monday account to obtain the server-only credential described below.
The Item View in your browser communicates only with monday (the platform, its API, and its file storage, from which it downloads the selected .eml or .msg file) and with the Email Viewer server on monday code. It loads no analytics, advertising, tracking, or other third-party scripts and sets no cookies.
Connecting your monday account
After you successfully authorize monday, the Email Viewer server stores one server-only OAuth access credential for your account in app-specific monday Secure Storage. It uses the credential only for a fresh subscription check before an AI request. Reconnecting the same account replaces the stored credential.
An hourly job on the Email Viewer server checks each stored credential with monday and deletes it once monday has refused it on two checks at least an hour apart. This happens after the app is uninstalled and whenever monday stops accepting the credential while the app is still installed. After an uninstall, the credential is deleted within 9 days; if deletion is not finished by then, the server reports it on every hourly run until it is resolved.
What is and is not retained
Email Viewer and its server do not store full emails, AI summaries, or session tokens. While a subitem-creation operation is unfinished, the app’s monday storage keeps the selected request names, due dates, exact quotes from the email, created subitem and board IDs, completed steps, and the last error. This record is visible to account users who open that email in that item.
The record is deleted when creation finishes or when it is discarded. If neither happens, it expires automatically 7 days after it was last saved. Discarding removes the saved operation record; subitems already created remain on the board. This pending subitem record is separate from the OAuth credential.
Deletion after uninstall
After Email Viewer is uninstalled from an account, the stored OAuth credential is deleted as described above, and the pending subitem records in the app’s monday storage expire automatically within 7 days of their last update, as every such record does. To schedule and confirm the credential deletion, the server keeps an index record in monday Document DB with a keyed hash of the account ID, internal identifiers of stored credentials, and check and due times; while an uninstall is being processed, it also holds the account ID and the time of the uninstall. It contains no credentials or email content and is removed after the deletion is confirmed. To request deletion of your account’s Email Viewer data at any other time, uninstall the app or contact us at [email protected].
Browser flags and operational logs
The browser keeps an AI-consent version and a first-time-guide-complete flag. The monday code logger records one line for each server request: method, path, response code, duration, monday account and user IDs, outcome, model, and token counts. These logs do not contain email text, subject, addresses, model output, session tokens, or headers. We do not state a retention period for platform logs here.
Board writes and protection
Email Viewer writes subitems and their updates only after you confirm creation. View-only users can read emails but cannot create subitems. The server rejects requests without a valid monday session token and limits request size and rate. To help avoid repeats or flag possible ones, the app reads the item’s subitems and recent updates; it does not retain that text for this check.
Questions about privacy
For privacy questions about Email Viewer, contact Pavel Krieger at acty.dev through [email protected]. Please do not send confidential email files to this address.